Extracted

• • Target
    c72a16f9d18a75f9ccc80bb1a3550e147c19a079700b1a7bfc752907656b06cf.bin
  • Size 868KB
  • SHA256 c72a16f9d18a75f9ccc80bb1a3550e147c19a079700b1a7bfc752907656b06cf
  • MD5 689d21259debd251d18f29e755ed5047
  • SHA1 0336278df771a71cac31a51b05aa4f3185cb9394
  • SHA512 45cb749426d997935bd9ff3598484aa518756a6690f86391b6b6b480f153273816f6168360dc4594b6d7ceacf7d0f5eab318b888c98ca0b62f6ed23337377861
  • SSDEEP 24576:iAU16OOVoz/NYN7VDJT0pcaM5KxPEJBvV0L:iASM0/NaLT0pi5WcJBN0L
  • TLSH
    T19B15F14867A8CD06C46A1774A8B4D2380B795E59FA12E3035FD8BEFB7D777228C14287
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryevasionexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2